Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

Issue 258's fix let a mesh seat's holder elsewhere answer before this machine's own provider. Right
for the resolver, which any provider answers alike; for the store's seat it re-bound every database
consumer on a machine running its own store to the holder on another, each was given a fresh, empty
database there, and nothing said so for twenty hours.

- An offer says whether it keeps its consumers' data (`keeps-consumer-data`); unsaid, a provider
  that grants each consumer a credential does. For such a provision the seat's holder no longer
  overrules a provider beside the consumer; a pin still does.
- Where each such consumer was sent is recorded (migration 0071). A resolution that would bind it
  elsewhere keeps the recorded provider and says the move; one whose provider is gone is refused,
  never answered by another.
- A push says a kept move and raises it as an urgent condition at once; the self-check's D12 raises
  it every run, with a pinned move not yet sent as a warning and any unasked move as urgent.

internal/catalogue/bound.go

@@ -0,0 +1,127 @@
+package catalogue
+
+import "fmt"
+
+// A consumer of a provision that keeps its data stays bound where its data is (novox/hq ADR 0232).
+//
+// **What a resolution chooses is not where a consumer's data is.** Resolving answers "which provider
+// would I pick now", from the seats' holders, the pins and what is assigned where, and every one of
+// those can change under a consumer without anybody meaning to move it. For a resolver that is the
+// point: any provider answers alike. For a database it is the consumer's whole state: on 2026-10-05
+// one change to how a seat's holder answers (issue 258) re-bound five database consumers on one
+// machine to the store on another, each was given a fresh, empty database there, and nothing warned
+// for twenty hours (issue 273). Nothing was lost only because the old provider kept everything.
+//
+// So the mesh records where each such consumer was last sent (the store's `binding` table), and a
+// resolution that would answer it from anywhere else keeps the recorded provider instead and says so.
+// **Only a pin moves it**, because a pin is a person: the one act that says "answer this machine's
+// consumers from there", taken knowing the data must go first.
+
+// KeptBinding is one consumer this resolution would have moved, and did not.
+type KeptBinding struct {
+	// Machine is where the consumer runs, and Consumer the module there that is bound.
+	Machine  string
+	Consumer string
+	// Provision is what it is bound for.
+	Provision string
+	// Bound is the provider it was recorded at, and still is; Would is the one the resolution chose.
+	Bound Chosen
+	Would Chosen
+}
+
+// String is the condition's sentence: the move, where the data is, and the act that confirms it.
+func (k KeptBinding) String() string {
+	return fmt.Sprintf("would move %s's %s from %s to %s — its data is on %s; kept there. "+
+		"`pin %s %s %s %s` to confirm a move (and move the data first)",
+		k.Consumer, k.Provision, k.Bound, k.Would, k.Bound, k.Machine, k.Provision, k.Would.Node, k.Would.Module)
+}
+
+// keepBound holds every need for a provision that keeps its consumers' data at the provider its
+// consumer was bound to, where the resolution chose another.
+//
+// A need with no record is a binding being made, and is left as resolved: it is recorded when it is
+// first sent. A pin naming the provider the resolution chose is a person moving it, and is left too.
+// Otherwise the recorded provider answers, if it still provides the provision — beside the consumer,
+// or offered from elsewhere — and the move is returned as kept. **One that no longer does is refused,
+// never answered by the provider chosen**: answering it there is exactly the silent move this exists
+// to stop, and the consumer's data is still wherever it was.
+func keepBound(needs []Needed, catalogue map[string]Manifest, node Node, world World,
+	keeps map[string]bool, here func(string) bool) ([]Needed, []KeptBinding, []string) {
+	var kept []KeptBinding
+	var problems []string
+	refused := map[[2]string]bool{}
+	out := make([]Needed, 0, len(needs))
+	for _, n := range needs {
+		if n.ByRecord || !keeps[n.Name] {
+			out = append(out, n)
+			continue
+		}
+		n.KeepsData = true
+		bound, recorded := world.Bound[n.For][n.Name]
+		chose := Chosen{Node: n.From, Module: n.Module}
+		if !recorded || sameProvider(bound, chose) {
+			out = append(out, n)
+			continue
+		}
+		if pin, pinned := world.Pinned[n.Name]; pinned && pin.matches(Provider{Node: chose.Node, Module: chose.Module}) {
+			out = append(out, n)
+			continue
+		}
+		held, ok, why := boundNeed(n, bound, catalogue, node, world, here)
+		if !ok {
+			if key := [2]string{n.For, n.Name}; !refused[key] {
+				refused[key] = true
+				problems = append(problems, fmt.Sprintf(
+					"%s on %s is bound to %s for %q, which keeps its data, and %s — it would move to %s, "+
+						"which holds none of it. Move its data and say so with `pin %s %s %s %s`, or give "+
+						"%s back what it provided",
+					n.For, node.Name, bound, n.Name, why, chose, node.Name, n.Name, chose.Node, chose.Module,
+					bound.Node))
+			}
+			continue
+		}
+		out = append(out, held)
+		kept = append(kept, KeptBinding{Machine: node.Name, Consumer: n.For, Provision: n.Name, Bound: bound, Would: chose})
+	}
+	return out, kept, problems
+}
+
+// sameProvider is whether a recorded provider is the one chosen. A record naming no module (none
+// is written without one, but a person's hand might) matches any module on its node.
+func sameProvider(bound, chose Chosen) bool {
+	return bound.Node == chose.Node && (bound.Module == "" || bound.Module == chose.Module)
+}
+
+// boundNeed is the need answered by the recorded provider, or why it cannot be.
+func boundNeed(n Needed, bound Chosen, catalogue map[string]Manifest, node Node, world World,
+	here func(string) bool) (Needed, bool, string) {
+	held := Needed{Name: n.Name, For: n.For, Local: n.Local, KeepsData: true}
+	if bound.Node == node.Name {
+		m, known := catalogue[bound.Module]
+		if !known || !here(bound.Module) || !providesAt(m, n.Name, ScopeMesh) {
+			return Needed{}, false, fmt.Sprintf("%s no longer runs on %s", bound.Module, node.Name)
+		}
+		at := node.At
+		if at == "" {
+			at = "127.0.0.1"
+		}
+		held.From, held.At, held.Module = node.Name, at, m.Module
+		held.Serves, held.SharedOwn, held.Identity = servedByOne(m, n.Name), sharedByOne(m, n.Name), m.IdentityBoundOf(n.Name)
+		return held, true, ""
+	}
+	matching := bound.among(world.Offered[n.Name])
+	if len(matching) != 1 {
+		return Needed{}, false, fmt.Sprintf("%s no longer provides it", bound)
+	}
+	p := matching[0]
+	if node.At == "" || p.At == "" {
+		return Needed{}, false, fmt.Sprintf("%s and %s are not both on the private network", node.Name, p.Node)
+	}
+	identity := DefaultIdentityBound
+	if pm, known := catalogue[p.Module]; known {
+		held.SharedOwn, _ = pm.SharedCredentialOf(n.Name)
+		identity = pm.IdentityBoundOf(n.Name)
+	}
+	held.From, held.At, held.Module, held.Serves, held.Identity = p.Node, p.At, p.Module, p.Serves, identity
+	return held, true, ""
+}

internal/catalogue/bound_test.go

@@ -0,0 +1,257 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// A consumer of a provision that keeps its data stays bound where its data is (novox/hq ADR 0232,
+// issue 273).
+//
+// The incident, exactly: a machine runs its own store and five consumers of it; the mesh's store seat
+// is held by the store on another machine. Issue 258's rule — the seat's holder elsewhere answers
+// before this machine's own provider — re-bound all five to the holder, each was made a fresh, empty
+// database there, and nothing said so.
+
+var incidentConsumers = []string{"board", "listings", "workflows", "agents", "game"}
+
+func storeMesh() map[string]Manifest {
+	shelf := map[string]Manifest{
+		"store": {Module: "store", Version: "1",
+			Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
+			Claims:   []Claim{{Name: "mesh-store", Scope: ScopeMesh}},
+			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+			Grants:   map[string]string{"postgres-database": "/grants"}},
+		"resolver": {Module: "resolver", Version: "1",
+			Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
+			Claims:   []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}},
+		"network": {Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
+	}
+	for _, c := range incidentConsumers {
+		shelf[c] = Manifest{Module: c, Version: "1", Requires: []string{"postgres-database"}}
+	}
+	return shelf
+}
+
+// storeWorld is the rest of the mesh as the home server's plan sees it: the anchor runs a store and a
+// resolver and holds both seats; the home server runs its own of each.
+func storeWorld() World {
+	w := World{Offered: map[string][]Provider{
+		"postgres-database": {
+			{Node: "anchor", At: "anchor.internal", Module: "store", Serves: map[string]any{"port": 5432}},
+			{Node: "home", At: "home.internal", Module: "store", Serves: map[string]any{"port": 5434}},
+		},
+		"wildcard-resolution": {
+			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
+			{Node: "home", At: "home.internal", Module: "resolver"},
+		},
+	}}
+	w.Held = []Held{
+		{Claim: "mesh-store", Scope: ScopeMesh, Node: "anchor", Module: "store"},
+		{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "anchor", Module: "resolver"},
+	}
+	w.Holdings = w.Held
+	return w
+}
+
+var home = Node{Name: "home", At: "home.internal"}
+
+func homeAssigned() []string {
+	return append([]string{"store", "resolver", "network"}, incidentConsumers...)
+}
+
+func boundFrom(t *testing.T, r Resolution, consumer, provision string) Needed {
+	t.Helper()
+	for _, n := range r.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("no binding of %s for %s: %+v", consumer, provision, r.Needs)
+	return Needed{}
+}
+
+func TestTheIncidentAMachinesOwnStoreKeepsItsConsumersWhenTheSeatIsHeldElsewhere(t *testing.T) {
+	got, err := Resolve(storeMesh(), homeAssigned(), home, storeWorld())
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range incidentConsumers {
+		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" || n.Module != "store" {
+			t.Errorf("%s bound to %s/%s; its data is on the store beside it (issue 273)", c, n.From, n.Module)
+		}
+	}
+	// And the resolver, which keeps nothing of anybody's, still answers from the seat's holder (258).
+	if n := boundFrom(t, got, "network", "wildcard-resolution"); n.From != "anchor" {
+		t.Errorf("the resolver bound to %s; the seat is held on anchor (issue 258)", n.From)
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("nothing was moved, and %d kept: %+v", len(got.Kept), got.Kept)
+	}
+}
+
+func TestTheIncidentWithEveryConsumerOnRecordStillMovesNothing(t *testing.T) {
+	w := storeWorld()
+	w.Bound = map[string]map[string]Chosen{}
+	for _, c := range incidentConsumers {
+		w.Bound[c] = map[string]Chosen{"postgres-database": {Node: "home", Module: "store"}}
+	}
+	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range incidentConsumers {
+		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" {
+			t.Errorf("%s bound to %s", c, n.From)
+		}
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("kept %+v", got.Kept)
+	}
+}
+
+func TestAPinElsewhereStillMovesAStoresConsumers(t *testing.T) {
+	w := storeWorld()
+	w.Pinned = map[string]Chosen{"postgres-database": {Node: "anchor", Module: "store"}}
+	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" || n.Module != "store" {
+		t.Errorf("bound to %s/%s; a person pinned it to anchor", n.From, n.Module)
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("a pin is a person's move, not one to keep: %+v", got.Kept)
+	}
+}
+
+// A consumer on a machine with no store of its own, bound to one store, when the seat moves to
+// another: the holder would answer, and the binding stays.
+func laptopWorld(holder string) World {
+	w := storeWorld()
+	w.Held = []Held{{Claim: "mesh-store", Scope: ScopeMesh, Node: holder, Module: "store"}}
+	w.Holdings = w.Held
+	return w
+}
+
+var laptop = Node{Name: "laptop", At: "laptop.internal"}
+
+func TestABoundConsumerStaysWhenTheSeatsHolderChanges(t *testing.T) {
+	w := laptopWorld("home")
+	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "anchor", Module: "store"}}}
+	got, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := boundFrom(t, got, "board", "postgres-database")
+	if n.From != "anchor" || n.At != "anchor.internal" || n.Serves["port"] != 5432 {
+		t.Fatalf("bound to %s at %s %v; its data is on anchor", n.From, n.At, n.Serves)
+	}
+	if len(got.Kept) != 1 {
+		t.Fatalf("the move was not said: %+v", got.Kept)
+	}
+	k := got.Kept[0]
+	if k.Bound != (Chosen{"anchor", "store"}) || k.Would != (Chosen{"home", "store"}) || k.Consumer != "board" {
+		t.Fatalf("kept %+v", k)
+	}
+	for _, want := range []string{"would move board's postgres-database from anchor/store to home/store",
+		"its data is on anchor/store", "pin laptop postgres-database home store", "move the data first"} {
+		if !strings.Contains(k.String(), want) {
+			t.Errorf("%q does not say %q", k.String(), want)
+		}
+	}
+	// Without a record it is a binding being made, and the holder answers it as before.
+	w.Bound = nil
+	got, err = Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "home" {
+		t.Errorf("a new consumer bound to %s; the seat is held on home", n.From)
+	}
+}
+
+func TestABoundConsumerWhoseProviderIsGoneIsRefusedNotMoved(t *testing.T) {
+	w := laptopWorld("anchor")
+	w.Offered["postgres-database"] = w.Offered["postgres-database"][:1] // only anchor's store is left
+	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	_, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err == nil {
+		t.Fatal("bound to home's store, which is gone, and answered by anchor's — the silent move")
+	}
+	for _, want := range []string{"board on laptop is bound to home/store", "home/store no longer provides it",
+		"pin laptop postgres-database anchor store"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("%q does not say %q", err, want)
+		}
+	}
+}
+
+func TestAMachinesOwnStoreUnassignedRefusesItsBoundConsumers(t *testing.T) {
+	w := storeWorld()
+	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	_, err := Resolve(storeMesh(), []string{"board"}, home, w)
+	if err == nil || !strings.Contains(err.Error(), "store no longer runs on home") {
+		t.Fatalf("got %v", err)
+	}
+}
+
+// The first pass asks only what a machine offers, and is never refused by a binding.
+func TestTheFirstPassKeepsNoBinding(t *testing.T) {
+	w := storeWorld()
+	w.Unchecked = true
+	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "gone", Module: "store"}}}
+	if _, err := Resolve(storeMesh(), []string{"board"}, laptop, w); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAnOfferSaysWhetherItKeepsConsumerData(t *testing.T) {
+	var o Offer
+	if err := json.Unmarshal([]byte(`{"name":"wildcard-resolution","scope":"mesh","keeps-consumer-data":false}`), &o); err != nil {
+		t.Fatal(err)
+	}
+	if o.KeepsConsumerData == nil || *o.KeepsConsumerData {
+		t.Fatalf("read %+v", o)
+	}
+	out, err := json.Marshal(o)
+	if err != nil || !strings.Contains(string(out), `"keeps-consumer-data":false`) {
+		t.Fatalf("wrote %s, %v", out, err)
+	}
+	yes, no := true, false
+	granting := Manifest{Module: "g", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}, Grants: map[string]string{"p": "/g"}}
+	if !granting.KeepsConsumerData("p") {
+		t.Error("a provider granting each consumer a credential keeps what it writes, unsaid")
+	}
+	if (Manifest{Module: "r", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}}).KeepsConsumerData("p") {
+		t.Error("a provider granting nothing keeps nothing, unsaid")
+	}
+	granting.Provides[0].KeepsConsumerData = &no
+	if granting.KeepsConsumerData("p") {
+		t.Error("what an offer says, it gets")
+	}
+	said := Manifest{Module: "s", Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &yes}}}
+	if !said.KeepsConsumerData("p") || !KeepsConsumerData(map[string]Manifest{"s": said, "r": {Module: "r",
+		Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &no}}}}, "p") {
+		t.Error("a name any provider says keeps data keeps data")
+	}
+}
+
+// An offer saying it keeps nothing is answered by the seat's holder as the resolver is, even where it
+// grants a credential.
+func TestAStoreSayingItKeepsNothingFollowsTheSeat(t *testing.T) {
+	shelf := storeMesh()
+	no := false
+	s := shelf["store"]
+	s.Provides = []Offer{{Name: "postgres-database", Scope: ScopeMesh, KeepsConsumerData: &no}}
+	shelf["store"] = s
+	got, err := Resolve(shelf, homeAssigned(), home, storeWorld())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" {
+		t.Errorf("bound to %s; it keeps nothing, and the seat is held on anchor", n.From)
+	}
+}

internal/catalogue/manifest.go

@@ -159,6 +159,11 @@ type Offer struct {
 	// from its consumer. Unsaid, the mesh assumes the tightest backend it knows when the provider is
 	// told its consumers, and no bound when it is not — see IdentityBoundOf.
 	Identity *OfferIdentity `json:"identity,omitempty"`
+	// KeepsConsumerData says whether this provision's provider keeps what its consumers write — a
+	// database's rows, a bucket's objects, a client's settings — so that a consumer bound to it is
+	// bound to its data, and moves only by a person (novox/hq ADR 0232). `false` for a provision any
+	// provider answers alike, the mesh's resolver; unsaid, see KeepsConsumerData.
+	KeepsConsumerData *bool `json:"keeps-consumer-data,omitempty"`
 }
 
 // OfferIdentity is what an offer says about the names its backend keeps for its consumers.
@@ -234,6 +239,40 @@ func (m Manifest) IdentityBoundOf(provision string) IdentityBound {
 	return IdentityBound{}
 }
 
+// KeepsConsumerData is whether this module, providing a provision, keeps what each consumer writes
+// there (novox/hq ADR 0232): whether a consumer bound to it is bound to its data.
+//
+// **What an offer says, it gets.** Unsaid, it follows from whether the provider grants each consumer
+// a credential of its own: a provider that does makes an account for every consumer — a role and its
+// database, a key and its bucket, a client — and what the consumer writes under that account stays
+// with that provider. One that grants nothing keeps nothing of anybody's: the resolver, a CA, the
+// artifact store each answer any consumer alike, and moving a consumer between two of them loses
+// nothing.
+func (m Manifest) KeepsConsumerData(provision string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision && o.KeepsConsumerData != nil {
+			return *o.KeepsConsumerData
+		}
+	}
+	_, grants := m.Grants[provision]
+	return grants
+}
+
+// KeepsConsumerData is whether a provision, by name, keeps its consumers' data across the
+// catalogue: true when any module providing it at the mesh's scope does. **A property of the name**,
+// as brokering is: two providers disagreeing would make the same binding sticky or free depending on
+// which one happened to answer it, and the safe reading of a disagreement is that it keeps data.
+func KeepsConsumerData(catalogue map[string]Manifest, provision string) bool {
+	for _, m := range catalogue {
+		for _, o := range m.Provides {
+			if o.Name == provision && o.At() == ScopeMesh && m.KeepsConsumerData(provision) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // MachineReach is whether a provision is usable only on its provider's own machine.
 func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }
 
@@ -286,20 +325,23 @@ func (o *Offer) UnmarshalJSON(raw []byte) error {
 		Credential *OfferCredential `json:"credential,omitempty"`
 		Reach      string           `json:"reach,omitempty"`
 		Identity   *OfferIdentity   `json:"identity,omitempty"`
+		Keeps      *bool            `json:"keeps-consumer-data,omitempty"`
 	}
 	dec := json.NewDecoder(bytes.NewReader(raw))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&full); err != nil {
-		return fmt.Errorf("a provided name is either a string or {name, scope, credential, reach, identity}: %w", err)
+		return fmt.Errorf("a provided name is either a string or {name, scope, credential, reach, identity, "+
+			"keeps-consumer-data}: %w", err)
 	}
 	o.Name, o.Scope, o.Credential, o.Reach, o.Identity = full.Name, full.Scope, full.Credential, full.Reach, full.Identity
+	o.KeepsConsumerData = full.Keeps
 	return nil
 }
 
 // MarshalJSON writes back the short form when there is nothing else to say, so a manifest that
 // went through the mesh comes out looking like the one that went in.
 func (o Offer) MarshalJSON() ([]byte, error) {
-	if o.Scope == "" && o.Credential == nil && o.Reach == "" && o.Identity == nil {
+	if o.Scope == "" && o.Credential == nil && o.Reach == "" && o.Identity == nil && o.KeepsConsumerData == nil {
 		return json.Marshal(o.Name)
 	}
 	return json.Marshal(struct {
@@ -308,7 +350,8 @@ func (o Offer) MarshalJSON() ([]byte, error) {
 		Credential *OfferCredential `json:"credential,omitempty"`
 		Reach      string           `json:"reach,omitempty"`
 		Identity   *OfferIdentity   `json:"identity,omitempty"`
-	}{o.Name, o.Scope, o.Credential, o.Reach, o.Identity})
+		Keeps      *bool            `json:"keeps-consumer-data,omitempty"`
+	}{o.Name, o.Scope, o.Credential, o.Reach, o.Identity, o.KeepsConsumerData})
 }
 
 // Manifest is everything a module says about itself.

internal/catalogue/resolve.go

@@ -54,6 +54,11 @@ type World struct {
 	// provider appears, and one recorded and then made unnecessary should not quietly stop applying
 	// either.
 	Pinned map[string]Chosen
+	// Bound is where each of this machine's consumers was bound for a provision that keeps its data
+	// (novox/hq ADR 0232), by consumer module then provision: the provider it was last sent, as the
+	// store recorded it. A resolution that would answer such a consumer from anywhere else keeps it
+	// where it is and says so (Resolution.Kept); only a pin naming the other provider moves it.
+	Bound map[string]map[string]Chosen
 	// Licences is every provision answered by a **record rather than a node**, by provision name.
 	//
 	// novox/hq ADR 0024: a hosted model is on nobody's machine and is reached over the public
@@ -151,6 +156,10 @@ type Resolution struct {
 	// 0207) — reported rather than refused while enforceSeatDependencies is off, so a node short of a
 	// holder still converges and `status` says what it is short of.
 	Unheld []Unheld
+	// Kept is every consumer this resolution would have moved to another provider of a provision
+	// that keeps its data, and did not (novox/hq ADR 0232): it stays bound where its data is, and the
+	// controller raises an urgent condition naming the move until a person pins one or the other.
+	Kept []KeptBinding
 }
 
 // Unhostable is one directly-assigned module the machine cannot run.
@@ -194,6 +203,13 @@ type Needed struct {
 	// state, not a consumer missing its key. Set by the plan, which is the only layer that knows a
 	// licence's manager; empty for every consumer.
 	Manager bool
+	// Module is the providing module on From, empty for a need answered by a record or by nothing
+	// that serves it. A provider is a (node, module) pair (novox/hq to-be 23), and a binding to data
+	// is a binding to the pair (ADR 0232).
+	Module string
+	// KeepsData is set when the provision keeps what its consumer writes (novox/hq ADR 0232): the
+	// binding is to the consumer's data, recorded when it is sent and moved only by a pin.
+	KeepsData bool
 	// Identity is the longest consumer identity the answering provision keeps (novox/hq ADR 0225),
 	// from the provider's own offer: what the mesh judges this consumer's identity against, on the
 	// consumer's side for `status` and on the provider's before it grants. No bound for a provision
@@ -229,10 +245,15 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 	// one happened to answer it.
 	brokered := map[string]bool{}
 	local := map[string]bool{}
+	// And which of them keep their consumers' data (novox/hq ADR 0232) — also a property of the name.
+	keeps := map[string]bool{}
 	for _, m := range catalogue {
 		for _, o := range m.Provides {
 			if o.At() == ScopeMesh {
 				brokered[o.Name] = true
+				if m.KeepsConsumerData(o.Name) {
+					keeps[o.Name] = true
+				}
 				continue
 			}
 			local[o.Name] = true
@@ -346,7 +367,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 		// trust boundary the moment both ends are containers**, and treating it as one gave the
 		// commonest arrangement of all — a service and its database on one node — the weakest
 		// handling, silently.
-		if satisfied[want] && !isModule(catalogue, want) && !answeredElsewhere(want, node, world, brokered) {
+		if satisfied[want] && !isModule(catalogue, want) && !answeredElsewhere(want, node, world, brokered, keeps) {
 			here := func(name string) bool { return chosen[name] || assignedHere[name] }
 			local := providersHere(catalogue, here, want)
 			// Which of them it matters to choose between. A plain capability — a shell, a display
@@ -406,7 +427,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 					at = "127.0.0.1"
 				}
 				needs = append(needs, Needed{
-					Name: want, From: node.Name, At: at,
+					Name: want, From: node.Name, At: at, Module: by.Module,
 					Serves: servedByOne(by, want), For: because[want],
 					SharedOwn: sharedByOne(by, want), Identity: by.IdentityBoundOf(want)})
 			} else if served := servedByOne(by, want); len(served) > 0 {
@@ -428,7 +449,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 					at = "127.0.0.1"
 				}
 				needs = append(needs, Needed{
-					Name: want, From: node.Name, At: at, Serves: served, For: because[want]})
+					Name: want, From: node.Name, At: at, Serves: served, For: because[want], Module: by.Module})
 			}
 			continue
 		}
@@ -459,7 +480,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 					shared, _ = pm.SharedCredentialOf(want)
 					bound = pm.IdentityBoundOf(want)
 				}
-				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At,
+				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At, Module: p.Module,
 					Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound})
 			}
 			switch {
@@ -619,6 +640,17 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 	// The record pass below already gets this right and says so. It is the same rule.
 	needs = perConsumer(needs, order, catalogue)
 
+	// **A consumer bound to its data stays bound to it** (novox/hq ADR 0232). Per consumer, after
+	// the fan-out, because a binding is a consumer's: the walk above chose one provider per name for
+	// the whole machine, and two consumers of it may have been bound at different times.
+	var kept []KeptBinding
+	if !world.Unchecked {
+		here := func(name string) bool { return chosen[name] || assignedHere[name] }
+		var stuck []string
+		needs, kept, stuck = keepBound(needs, catalogue, node, world, keeps, here)
+		problems = append(problems, stuck...)
+	}
+
 	// What is answered by a record rather than by a machine.
 	//
 	// A post-pass, deliberately: nothing about it depends on the order requirements were walked
@@ -668,7 +700,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 
 	resolution := Resolution{Node: node.Name, At: node.At, PublicDomain: node.PublicDomain,
 		Account: node.Account, AccountHome: node.AccountHome,
-		Because: because, Needs: needs, Unhostable: unhostable}
+		Because: because, Needs: needs, Unhostable: unhostable, Kept: kept}
 	for _, n := range providersFirst(order, catalogue) {
 		resolution.Modules = append(resolution.Modules, catalogue[n])
 	}
@@ -1215,13 +1247,23 @@ func machineReachRemedy(catalogue map[string]Manifest, want, node string) string
 // overrule a pin somebody set on this machine.
 //
 // Not in the first pass, which asks only what this machine offers and has no providers to read.
-func answeredElsewhere(want string, node Node, world World, brokered map[string]bool) bool {
+//
+// **And never by the seat alone for a provision that keeps its consumers' data** (novox/hq ADR
+// 0232). The rule above was written for the mesh's resolver, which any provider answers alike. Read
+// for the store's seat, it re-bound every database consumer on a machine running its own store to
+// the seat's holder on another machine, which made each of them a fresh, empty database there and
+// left their data behind (novox/hq issue 273). A provider beside a consumer of its data is where that
+// data is; only a pin — a person — answers it from elsewhere.
+func answeredElsewhere(want string, node Node, world World, brokered, keeps map[string]bool) bool {
 	if world.Unchecked || !brokered[want] {
 		return false
 	}
 	if c, pinned := world.Pinned[want]; pinned {
 		return c.Node != node.Name
 	}
+	if keeps[want] {
+		return false
+	}
 	// **A machine holding the seat answers itself** (novox/hq ADR 0223). With a replicated seat
 	// another machine holds it too, and the first holder in the providers' order may be that one; a
 	// holder is still where this machine's own requirement is answered, so its resolver file lists